chapter-3/chapter-3.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "16ef4aae-e71b-4940-8c47-76d1426f3c7c",
   "metadata": {},
   "source": [
    "# Chapter 3: Rust's Cryptographic Strengths and Vulnerabilities\n",
    "\n",
    "## Introduction\n",
    "\n",
    "In this chapter, our exploration into Rust's cryptographic landscape reveals a canvas of libraries and tools designed to strengthen digital communications. At the forefront stands the [`rustls`](https://github.com/rustls/rustls) library, a robust Rust implementation of TLS, which serves as the cornerstone for securing SSL/TLS communications. Configuring a secure server involves creating an instance of [`ServerConfig`](https://docs.rs/rustls/latest/rustls/server/struct.ServerConfig.html) and tailoring it to specific needs, such as cipher suite preferences and key management. Rust's type safety and expressive syntax contribute to a more resilient implementation, mitigating common pitfalls associated with memory safety.\n",
    "\n",
    "Beyond the SSL/TLS domain, Rust empowers us to tackle the complexities of [mutual authentication](https://en.wikipedia.org/wiki/Mutual_authentication) using the [`openssl`](https://en.wikipedia.org/wiki/OpenSSL) library. This involves crafting a secure handshake process where both client and server authenticate each other's identity through [X.509](https://en.wikipedia.org/wiki/X.509) certificates. Configuring an SSL acceptor involves loading server certificates and private keys while establishing trust relationships through [CA certificates](https://en.wikipedia.org/wiki/Certificate_authority). Rust's emphasis on [ownership](https://doc.rust-lang.org/book/ch04-00-understanding-ownership.html) and [lifetimes](https://doc.rust-lang.org/book/ch10-00-generics.html#generic-types-traits-and-lifetimes) ensures that [cryptographic keys](https://en.wikipedia.org/wiki/Key_(cryptography)) and sensitive data are managed securely throughout the authentication process, reducing the risk of memory leaks and unauthorized access.\n",
    "\n",
    "As we navigate Rust's cryptographic terrain, [symmetric-key cryptography](https://en.wikipedia.org/wiki/Symmetric-key_algorithm) emerges as a pivotal aspect, facilitated by libraries like [`crypto`](https://crates.io/crates/crypto). Our exploration takes us into the domain of [the Advanced Encryption Standard (AES)](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard), where data [encryption](https://en.wikipedia.org/wiki/Encryption) and [decryption](https://en.wikipedia.org/wiki/Encryption) become intricate dances with key sizes and block modes. [Rust's focus on zero-cost abstractions](https://doc.rust-lang.org/beta/embedded-book/static-guarantees/zero-cost-abstractions.html) and performance ensures that cryptographic operations are executed efficiently, catering to the demands of secure data transmission. Leveraging Rust's [concurrency model](https://doc.rust-lang.org/book/ch16-00-concurrency.html), we can parallelize cryptographic tasks, enhancing throughput without compromising security."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4ec4ed77-fddd-4358-85b8-401115926814",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true
   },
   "source": [
    "## Table of Contents\n",
    "\n",
    "* [**Cryptography in Rust**](#1.-Cryptography-in-Rust)\n",
    "    * [**Encryption and Decryption**](#1.1-Encryption-and-Decryption)\n",
    "    * [**Hashing**](#1.2-Hashing)\n",
    "       * [**Cracking MD5 Hashes**](#1.2.1-Cracking-MD5-Hashes)\n",
    "       * [**Implementing bcrypt**](#1.2.2-Implementing-bcrypt)\n",
    "    * [**Message Authentication**](#1.3-Message-Authentication)\n",
    "    * [**Symmetric Encryption**](#1.4-Symmetric-Encryption)\n",
    "    * [**Asymmetric Encryption**](#1.5-Asymmetric-Encryption)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ccc15f26-08eb-425e-8875-c6265b6de47c",
   "metadata": {},
   "source": [
    "## 1. Cryptography in Rust\n",
    "\n",
    "Before kicking off our exploration of cryptographic operations in Rust, it's essential to immerse ourselves in the fundamental concepts that make this complex field. We'll traverse these concepts meticulously to ensure a robust comprehension of the cryptographic landscape.\n",
    "\n",
    "### 1.1 Encryption and Decryption\n",
    "\n",
    "[Encryption](https://en.wikipedia.org/wiki/Encryption), a part of cryptography, surpasses mere confidentiality maintenance. It represents a dual-purpose functionality, allowing data scrambling and subsequent unscrambling. At its core, encryption involves a cryptographic function, that takes both data and a key as inputs, yielding either ciphertext or the original cleartext. [Symmetric algorithms](https://en.wikipedia.org/wiki/Symmetric-key_algorithm) work with a single key for both encryption and decryption, while [asymmetric](https://en.wikipedia.org/wiki/Public-key_cryptography) counterparts work with different keys.\n",
    "\n",
    "At the heart of our cryptographic exploration lies [ChaCha20Poly1305](https://en.wikipedia.org/wiki/ChaCha20-Poly1305) using the [`chacha20poly1305`](https://docs.rs/chacha20poly1305/latest/chacha20poly1305/index.html) crate, a cipher notable for its simplicity and speed. The underlying [ChaCha20](https://en.wikipedia.org/wiki/Salsa20#ChaCha_variant) stream cipher, employing a blend of add, rotate, and XOR instructions (ARX), works seamlessly with the straightforward [Poly1305](https://en.wikipedia.org/wiki/Poly1305) hash function. While not universally endorsed by standards bodies like [NIST](https://en.wikipedia.org/wiki/National_Institute_of_Standards_and_Technology), ChaCha20Poly1305 is widely adopted, being mandatory in the [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security) protocol.\n",
    "\n",
    "```rust\n",
    "use chacha20poly1305::{aead::{Aead, KeyInit, OsRng}, ChaCha20Poly1305, Nonce, AeadCore};\n",
    "use base64::{Engine as _, engine::{self, general_purpose}, alphabet};\n",
    "{\n",
    "    let key = ChaCha20Poly1305::generate_key(&mut OsRng);\n",
    "    let cipher = ChaCha20Poly1305::new(&key);\n",
    "    let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);\n",
    "    let plaintext = \"Hello, Rust Cryptography!\";\n",
    "    \n",
    "    // Encryption\n",
    "    let ciphertext = cipher.encrypt(&nonce, plaintext.as_bytes())?;\n",
    "    let b64_ciphertext = general_purpose::STANDARD.encode(&ciphertext);\n",
    "    println!(\"Base64 Cipher Text: {}\", b64_ciphertext);\n",
    "\n",
    "    // Decryption\n",
    "    let decrypted_text = cipher.decrypt(&nonce, &*ciphertext)?;\n",
    "    println!(\"Decrypted Text: {}\", String::from_utf8_lossy(&decrypted_text));\n",
    "}\n",
    "```\n",
    "\n",
    "```sh\n",
    "+---------------------------------------+\n",
    "|          ChaCha20Poly1305             |\n",
    "|                                       |\n",
    "|             +--------------+          |\n",
    "|             |   Generate   |          |\n",
    "|             |     Key      |          |\n",
    "|             +--------------+          |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "|             +--------------+          |\n",
    "|             |    Create    |          |\n",
    "|             |    Cipher    |          |\n",
    "|             +--------------+          |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "|             +--------------+          |\n",
    "|             | Generate Non-|          |\n",
    "|             |      ce      |          |\n",
    "|             +--------------+          |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "|     +--------------------------+      |\n",
    "|     |    Encrypt Plaintext     |      |\n",
    "|     |  using Key and Nonce     |      |\n",
    "|     +--------------------------+      |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "|              +--------------+         |\n",
    "|              |     Encode   |         |\n",
    "|              |  to Base64   |         |\n",
    "|              +--------------+         |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "| +---------------------------------+   |\n",
    "| |      Print Base64 Ciphertext    |   |\n",
    "| +---------------------------------+   |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "| +---------------------------------+   |\n",
    "| |        Decrypt Ciphertext       |   |\n",
    "| |  using Key and Nonce (same as   |   |\n",
    "| |        encryption phase)        |   |\n",
    "| +---------------------------------+   |\n",
    "|                     |                 |\n",
    "|                     V                 |\n",
    "| +---------------------------------+   |\n",
    "| |   Print Decrypted Plaintext     |   |\n",
    "| +---------------------------------+   |\n",
    "+---------------------------------------+\n",
    "```\n",
    "\n",
    "Encryption works like a protector for information moving from one place to another and a keeper of important data stored away. It waits to be unlocked for later use or carefully watched for any signs of deceitful actions."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "65025c10-3b69-401b-a2a5-774075f75edf",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep chacha20poly1305 = {version=\"0.10.1\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "1025ac0d-32c7-48f0-ab04-43d7aa90ee80",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep base64 = {version=\"0.21.5\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "c93ee33d-ba6b-4d8f-ac30-56623261c108",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Base64 Cipher Text: lOE/Ps3i63+RU8iZcoGYABZOpUqDHqMoVGpF4jFk7w97FZPOXm7Ka4Y=\n",
      "Decrypted Text: Hello, Rust Cryptography!\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "()"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "use chacha20poly1305::{aead::{Aead, KeyInit, OsRng}, ChaCha20Poly1305, Nonce, AeadCore};\n",
    "use base64::{Engine as _, engine::{self, general_purpose}, alphabet};\n",
    "{\n",
    "    let key = ChaCha20Poly1305::generate_key(&mut OsRng);\n",
    "    let cipher = ChaCha20Poly1305::new(&key);\n",
    "    let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);\n",
    "    let plaintext = \"Hello, Rust Cryptography!\";\n",
    "    \n",
    "    // Encryption\n",
    "    let ciphertext = cipher.encrypt(&nonce, plaintext.as_bytes())?;\n",
    "    let b64_ciphertext = general_purpose::STANDARD.encode(&ciphertext);\n",
    "    println!(\"Base64 Cipher Text: {}\", b64_ciphertext);\n",
    "\n",
    "    // Decryption\n",
    "    let decrypted_text = cipher.decrypt(&nonce, &*ciphertext)?;\n",
    "    println!(\"Decrypted Text: {}\", String::from_utf8_lossy(&decrypted_text));\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b810c9b1-7373-45f8-9344-67687f4de598",
   "metadata": {},
   "source": [
    "Note that the coded message is printed as a string encoded in base64, and the decoded message is displayed as a standard UTF-8 string. "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3529eb39-c07d-4abf-a546-4023654b046c",
   "metadata": {},
   "source": [
    "### 1.2 Hashing\n",
    "\n",
    "[Hashing](https://en.wikipedia.org/wiki/Hash_function) stands as a fundamental cryptographic process, operating as a unidirectional function meticulously crafted to produce a fixed-length and inherently unique output, all delegation upon a variable-length input. Its complex elegance lies in the irreversible nature of the transformation, blocking any possibility of figuring out the original input from the resultant hash value. This cryptographic technique finds its power in various scenarios, particularly those where the preservation of the original cleartext source becomes unnecessary for subsequent processing or to guarantee the integrity of data. An exemplary manifestation of secure practices within the domain of information protection is the storage of hashed passwords, a practice ideally complemented by the introduction of [salt](https://en.wikipedia.org/wiki/Salt_(cryptography)) - an additional layer of randomized data. This cryptographic seasoning enhances the unpredictability of the hash values, strengthening security and aligning with best practices in safeguarding sensitive information.\n",
    "\n",
    "In our exploration of hashing within the Rust programming language, we delve into two illustrative examples. The first demonstrates the cracking of MD5 hashes through an offline [dictionary attack](https://en.wikipedia.org/wiki/Dictionary_attack) using the [`md-5`](https://docs.rs/md-5) crate, employing Rust's capabilities to generate and compare hash values systematically. The second example showcases the implementation of [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) using the [`bcrypt`](https://github.com/Keats/rust-bcrypt) crate, an advanced algorithm enhancing the security of sensitive data such as passwords. Rust's versatility shines as it seamlessly integrates these cryptographic techniques, emphasizing its adaptability in addressing diverse security challenges.\n",
    "\n",
    "#### 1.2.1 Cracking MD5 Hashes\n",
    "\n",
    "Let's examine the code for cracking MD5 hashes in Rust:\n",
    "\n",
    "```rust\n",
    "use md5::{Md5, Digest};\n",
    "use hex_literal::hex;\n",
    "\n",
    "let md5_hash = hex!(\"517e90f2a52e730701a5d7ec89ef0f40\");\n",
    "\n",
    "let wordlist = vec![\"p@ssword231\", \"12345656789\", \"password\", \"Password\", \"Mahmoud123\"];\n",
    "\n",
    "for password in wordlist {\n",
    "    let mut md5_hasher = Md5::new();\n",
    "    md5_hasher.update(password);\n",
    "    let md5_generated = md5_hasher.finalize();\n",
    "    let md5_hex_string: String = md5_generated.iter().map(|byte| format!(\"{:02x}\", byte)).collect();\n",
    "\n",
    "    println!(\"[INFO] Trying hash {:?}\", md5_hex_string);\n",
    "    if md5_generated[..] == md5_hash {\n",
    "        println!(\"[INFO] Password found (MD5): {}\", password);\n",
    "    }\n",
    "}\n",
    "```\n",
    "\n",
    "```sh\n",
    "+----------------------------------+\n",
    "|            MD5 Cracking          |\n",
    "|                                  |\n",
    "|   +--------------+               |\n",
    "|   |   Provided   |               |\n",
    "|   |   MD5 Hash   |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   | Create Vec   |               |\n",
    "|   | of Passwords |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   |  Iterate     |               |\n",
    "|   |  through     |               |\n",
    "|   |  Wordlist    |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   |   MD5 Hash   |               |\n",
    "|   |  Calculation |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   | Convert to   |               |\n",
    "|   | Hex String   |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   |   Print MD5  |               |\n",
    "|   |  Hash (Info) |               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   | Compare with |               |\n",
    "|   | Provided Hash|               |\n",
    "|   +--------------+               |\n",
    "|               |                  |\n",
    "|               V                  |\n",
    "|   +--------------+               |\n",
    "|   |   Print      |               |\n",
    "|   | Password if  |               |\n",
    "|   | Matched      |               |\n",
    "|   +--------------+               |\n",
    "+----------------------------------+\n",
    "```\n",
    "\n",
    "In this Rust example, we start by defining variable `md5_hash` that hold the target hash value. This hash were obtained post-exploitation, and the goal is to discover the cleartext passwords that produced it. The code reads from a vector of strings, generating MD5 hashes for each password and comparing them with the target hash."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "449c8768-fcd6-4375-91ec-68f0c3839b8c",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep md-5 = {version=\"0.10.6\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "9fc69a62-99fc-4ece-b1ee-a738fa1a5b11",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep hex-literal = {version=\"0.4.1\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "d9bcef69-25f1-4523-bed2-6c3f6d7301f5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[INFO] Trying hash \"ab2d83f72c018c04bda54551f7963e30\"\n",
      "[INFO] Trying hash \"576333879d388b3537287481aa07f7c6\"\n",
      "[INFO] Trying hash \"5f4dcc3b5aa765d61d8327deb882cf99\"\n",
      "[INFO] Trying hash \"dc647eb65e6711e155375218212b3964\"\n",
      "[INFO] Trying hash \"517e90f2a52e730701a5d7ec89ef0f40\"\n",
      "[INFO] Password found (MD5): Mahmoud123\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "()"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "use md5::{Md5, Digest};\n",
    "use hex_literal::hex;\n",
    "\n",
    "let md5_hash = hex!(\"517e90f2a52e730701a5d7ec89ef0f40\");\n",
    "\n",
    "let wordlist = vec![\"p@ssword231\", \"12345656789\", \"password\", \"Password\", \"Mahmoud123\"];\n",
    "\n",
    "for password in wordlist {\n",
    "    let mut md5_hasher = Md5::new();\n",
    "    md5_hasher.update(password);\n",
    "    let md5_generated = md5_hasher.finalize();\n",
    "    let md5_hex_string: String = md5_generated.iter().map(|byte| format!(\"{:02x}\", byte)).collect();\n",
    "\n",
    "    println!(\"[INFO] Trying hash {:?}\", md5_hex_string);\n",
    "    if md5_generated[..] == md5_hash {\n",
    "        println!(\"[INFO] Password found (MD5): {}\", password);\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ff458618-31a3-48f3-90a6-530ec2ae920d",
   "metadata": {},
   "source": [
    "#### 1.2.2 Implementing bcrypt\n",
    "\n",
    "Now, let's explore how to use bcrypt to encrypt and authenticate passwords in Rust:\n",
    "\n",
    "```rust\n",
    "use bcrypt::{DEFAULT_COST, hash, verify};\n",
    "\n",
    "let stored_hash = \"$2b$12$gPxgyRNV5G/DTaADM4rnuu3LcEbQeVdqhdNaKobgmdiNeyNRmV2me\";\n",
    "\n",
    "let password = \"p@ssword123\";\n",
    "\n",
    "// Hash the password using bcrypt\n",
    "let hashed = hash(password, DEFAULT_COST)?;\n",
    "\n",
    "println!(\"Generated Hash: {}\", hashed);\n",
    "\n",
    "// Verify the hashed password against the stored hash\n",
    "if verify(password, &stored_hash)? {\n",
    "    println!(\"[INFO] Authentication successful\");\n",
    "} else {\n",
    "    println!(\"[INFO] Authentication failed\");\n",
    "}\n",
    "```\n",
    "\n",
    "```sh\n",
    "+------------------------------------+\n",
    "|               bcrypt               |\n",
    "|                                    |\n",
    "|     +-----------------------+      |\n",
    "|     |     Hash Password     |      |\n",
    "|     |                       |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |  | Cost Generation|   |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |           |           |      |\n",
    "|     |           V           |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |  |   Hash Function |  |      |\n",
    "|     |  | (bcrypt algorithm)||      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |           |           |      |\n",
    "|     |           V           |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |  |    Salt + Cost  |  |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |           |           |      |\n",
    "|     |           V           |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |  |  Generate Hash  |  |      |\n",
    "|     |  +-----------------+  |      |\n",
    "|     |           |           |      |\n",
    "|     |           V           |      |\n",
    "| +--------------------------+|      |\n",
    "| |      Print Generated     ||      |\n",
    "| |        Hash Value        ||      |\n",
    "| +--------------------------+|      |\n",
    "|           |                 |      |\n",
    "|           V                 |      |\n",
    "| +--------------------------+|      |\n",
    "| |  Verify Hashed Password  ||      |\n",
    "| +--------------------------+|      |\n",
    "|           |                 |      |\n",
    "|           V                 |      |\n",
    "| +--------------------------+|      |\n",
    "| | Print Authentication Info||      |\n",
    "| +--------------------------+|      |\n",
    "+------------------------------------+\n",
    "\n",
    "```\n",
    "\n",
    "In this Rust example, we utilize the [`bcrypt`](https://docs.rs/bcrypt) crate to implement bcrypt hashing and authentication. The [`hash`](https://docs.rs/bcrypt/latest/bcrypt/fn.hash.html) function generates a bcrypt hash from a cleartext password, and [`verify`](https://docs.rs/bcrypt/latest/bcrypt/fn.verify.html) is used to compare the generated hash with a stored hash to authenticate the password. The cost factor ensures the algorithm's resource-intensive nature, enhancing security against brute-force attacks."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "7c18c682-0fbd-487e-8e29-b0a55c844473",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep bcrypt = {version=\"0.15.0\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "e5b96965-8a7c-414d-a9ec-b5200c0de3d8",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Generated Hash: $2b$12$TZj8KWVRZ2YarPsY8LdhA.hX3ezZIVjrgWA8y91EDypHVmTq/x.ES\n",
      "[INFO] Authentication successful\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "()"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "use bcrypt::{DEFAULT_COST, hash, verify};\n",
    "\n",
    "let stored_hash = \"$2b$12$gPxgyRNV5G/DTaADM4rnuu3LcEbQeVdqhdNaKobgmdiNeyNRmV2me\";\n",
    "\n",
    "let password = \"p@ssword123\";\n",
    "\n",
    "// Hash the password using bcrypt\n",
    "let hashed = hash(password, DEFAULT_COST)?;\n",
    "\n",
    "println!(\"Generated Hash: {}\", hashed);\n",
    "\n",
    "// Verify the hashed password against the stored hash\n",
    "if verify(password, &stored_hash)? {\n",
    "    println!(\"[INFO] Authentication successful\");\n",
    "} else {\n",
    "    println!(\"[INFO] Authentication failed\");\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b92d5e6a-2b3d-4d03-9182-03810e6ed01f",
   "metadata": {},
   "source": [
    "These Rust examples provide insights into the practical application of hashing and bcrypt in real-world scenarios. As we delve into Rust's cryptographic features, a deeper understanding of these concepts will empower your cryptographic journey."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7df1c26d-276b-45d3-988b-ba71e2795f19",
   "metadata": {},
   "source": [
    "### 1.3 Message Authentication\n",
    "\n",
    "When we exchange messages, we want to be certain that the data hasn't been altered during transmission by someone unauthorized. Additionally, we need to confirm that the message is genuinely from an authorized sender and not a forgery by another entity. To tackle these concerns, we can utilize the `ring` crate, which provides robust cryptographic functionalities. Specifically, we will employ the HMAC (Hash-based Message Authentication Code) algorithm, a widely accepted standard for ensuring message integrity and source authenticity.\n",
    "\n",
    "The HMAC algorithm involves a hashing function and a shared secret key known only to authorized parties. Attempting to forge a valid HMAC without possessing this shared secret becomes highly improbable.\n",
    "\n",
    "Implementing HMAC in Rust is straightforward with the `ring` crate. Let's explore an example that demonstrates how to achieve message authentication securely.\n",
    "\n",
    "```rust\n",
    "use ring::hmac;\n",
    "use ring::rand::{SecureRandom, SystemRandom};\n",
    "use ring::error::Unspecified;\n",
    "use ring::constant_time;\n",
    "use hex;\n",
    "\n",
    "const KEY_SIZE: usize = ring::digest::SHA256_OUTPUT_LEN;\n",
    "const MESSAGE: &str = \"Attach at 12:30\";\n",
    "\n",
    "fn generate_key(rng: &SystemRandom) -> Result<hmac::Key, Unspecified> {\n",
    "    let mut key_value = [0u8; KEY_SIZE];\n",
    "    rng.fill(&mut key_value)?;\n",
    "    Ok(hmac::Key::new(hmac::HMAC_SHA256, &key_value))\n",
    "}\n",
    "\n",
    "fn generate_hmac(key: &hmac::Key, message: &[u8]) -> hmac::Tag {\n",
    "    hmac::sign(key, message)\n",
    "}\n",
    "\n",
    "fn verify_hmac(key: &hmac::Key, message: &[u8], received_tag: &[u8]) -> Result<(), Unspecified> {\n",
    "    let calculated_tag = generate_hmac(key, message);\n",
    "    constant_time::verify_slices_are_equal(calculated_tag.as_ref(), received_tag)\n",
    "}\n",
    "\n",
    "let rng = SystemRandom::new();\n",
    "\n",
    "// Sender side\n",
    "let key = generate_key(&rng).expect(\"Failed to generate key\");\n",
    "let tag = generate_hmac(&key, MESSAGE.as_bytes());\n",
    "\n",
    "// Simulate transmission (In a real implementation, this would be sent over the network)\n",
    "\n",
    "// Receiver side\n",
    "let received_tag_hex = \"69d2c7b6fbbfcaeb72a3172f4662601d1f16acfb46339639ac8c10c8da64631d\";\n",
    "let received_tag = hex::decode(received_tag_hex).expect(\"Failed to decode received tag\");\n",
    "\n",
    "match verify_hmac(&key, MESSAGE.as_bytes(), &received_tag) {\n",
    "    Ok(()) => println!(\"[INFO] Message is authentic\"),\n",
    "    Err(_) => println!(\"[INFO] Message may be tampered\"),\n",
    "}\n",
    "```\n",
    "\n",
    "```sh\n",
    "+----------------------+\n",
    "|        Sender        |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|    Generate Key      |\n",
    "|   using SystemRandom |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|   Generate HMAC      |\n",
    "|   using Key and      |\n",
    "|   Message            |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|    Transmit Message  |\n",
    "|   and HMAC (simulate |\n",
    "|   network transfer)  |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|       Receiver       |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|   Decode Received    |\n",
    "|   HMAC from Hex      |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|   Verify HMAC        |\n",
    "|   using Key and      |\n",
    "|   Received HMAC      |\n",
    "+----------------------+\n",
    "         |\n",
    "         V\n",
    "+----------------------+\n",
    "|   Print Result       |\n",
    "|  (Authentic/Tampered)|\n",
    "+----------------------+\n",
    "```\n",
    "\n",
    "In this Rust example, the `key` variable represents the shared secret key. In a real-world scenario, this key would be securely managed and shared between authorized endpoints.\n",
    "\n",
    "The `verify_hmac` function takes a key, a message, and the received HMAC as parameters. It calculates the HMAC using the `ring` crate and compares it in constant time to mitigate timing attacks. The subsequent statements simulate the reception of a message, decoding the received HMAC from a hex string.\n",
    "\n",
    "By employing Rust's `ring` crate, we ensure a secure and efficient implementation of HMAC for message authentication, addressing concerns related to data tampering and source legitimacy. This example simplifies the process for clarity, focusing solely on HMAC functionality without incorporating network communication aspects."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "8a9d741e-2039-46df-bb03-5c4913fc0188",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep ring = {version = \"0.17.7\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "789e744f-d5f5-4bc5-9534-e777e17960bc",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep hex = {version = \"0.4.3\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "01a5425b-ef1f-4feb-b154-3cab520458ba",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[INFO] Message may be tampered\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "()"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "use ring::hmac;\n",
    "use ring::rand::{SecureRandom, SystemRandom};\n",
    "use ring::error::Unspecified;\n",
    "use ring::constant_time;\n",
    "use hex;\n",
    "\n",
    "const KEY_SIZE: usize = ring::digest::SHA256_OUTPUT_LEN;\n",
    "const MESSAGE: &str = \"Attach at 12:30\";\n",
    "\n",
    "fn generate_key(rng: &SystemRandom) -> Result<hmac::Key, Unspecified> {\n",
    "    let mut key_value = [0u8; KEY_SIZE];\n",
    "    rng.fill(&mut key_value)?;\n",
    "    Ok(hmac::Key::new(hmac::HMAC_SHA256, &key_value))\n",
    "}\n",
    "\n",
    "fn generate_hmac(key: &hmac::Key, message: &[u8]) -> hmac::Tag {\n",
    "    hmac::sign(key, message)\n",
    "}\n",
    "\n",
    "fn verify_hmac(key: &hmac::Key, message: &[u8], received_tag: &[u8]) -> Result<(), Unspecified> {\n",
    "    let calculated_tag = generate_hmac(key, message);\n",
    "    constant_time::verify_slices_are_equal(calculated_tag.as_ref(), received_tag)\n",
    "}\n",
    "\n",
    "let rng = SystemRandom::new();\n",
    "\n",
    "// Sender side\n",
    "let key = generate_key(&rng).expect(\"Failed to generate key\");\n",
    "let tag = generate_hmac(&key, MESSAGE.as_bytes());\n",
    "\n",
    "// Simulate transmission (In a real implementation, this would be sent over the network)\n",
    "\n",
    "// Receiver side\n",
    "let received_tag_hex = \"69d2c7b6fbbfcaeb72a3172f4662601d1f16acfb46339639ac8c10c8da64631d\";\n",
    "let received_tag = hex::decode(received_tag_hex).expect(\"Failed to decode received tag\");\n",
    "\n",
    "match verify_hmac(&key, MESSAGE.as_bytes(), &received_tag) {\n",
    "    Ok(()) => println!(\"[INFO] Message is authentic\"),\n",
    "    Err(_) => println!(\"[INFO] Message may be tampered\"),\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3a10e631-4549-43e8-9202-a9bd90e40469",
   "metadata": {},
   "source": [
    "### 1.4 Symmetric Encryption"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ad868439-f9bc-44e6-bd96-7fae4110d01b",
   "metadata": {},
   "source": [
    "In the realm of Rust development, we embark on a journey into the world of encryption, focusing our attention on the foundational concept of [symmetric-key encryption](https://en.wikipedia.org/wiki/Symmetric-key_algorithm). This cryptographic approach employs a single secret key for both the encryption and decryption processes. Rust, with its robust ecosystem, facilitates the implementation of symmetric cryptography by supporting a variety of common algorithms within its default or extended packages.\n",
    "\n",
    "Let's delve into a practical example within the Rust paradigm. Picture a scenario where a breach has occurred in an organization, granting access to an e-commerce web server and its backend database housing encrypted financial transactions. The encryption algorithm in play is the Advanced Encryption Standard (AES), specifically operating in Cipher Block Chaining (CBC) mode. The following Rust code snippet illustrates two functions responsible for encrypting and decrypting credit card information encrypted using AES in CBC mode.\n",
    "\n",
    "```rust\n",
    "use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};\n",
    "use cbc::{Encryptor, Decryptor};\n",
    "use hex_literal::hex;\n",
    "\n",
    "type Aes128CbcEnc = Encryptor<aes::Aes128>;\n",
    "type Aes128CbcDec = Decryptor<aes::Aes128>;\n",
    "\n",
    "fn encrypt_cbc(key: &[u8], iv: &[u8], plaintext: &[u8]) -> Vec<u8> {\n",
    "    let mut buf = Vec::from(plaintext);\n",
    "    let cipher = Aes128CbcEnc::new(key.into(), iv.into());\n",
    "    cipher.encrypt_padded_vec_mut::<Pkcs7>(&mut buf)\n",
    "}\n",
    "\n",
    "fn decrypt_cbc(key: &[u8], iv: &[u8], ciphertext: &[u8]) -> Vec<u8> {\n",
    "    let mut buf = Vec::from(ciphertext);\n",
    "    let cipher = Aes128CbcDec::new(key.into(), iv.into());\n",
    "    cipher.decrypt_padded_vec_mut::<Pkcs7>(&mut buf).unwrap()\n",
    "}\n",
    "\n",
    "let key = [0x42; 16];\n",
    "let iv = [0x24; 16];\n",
    "let plaintext = *b\"Hello, World!\";\n",
    "\n",
    "// Encrypt\n",
    "let ciphertext = encrypt_cbc(&key, &iv, &plaintext);\n",
    "println!(\"Encrypted Text: {:?}\\n\", String::from_utf8_lossy(&ciphertext));\n",
    "\n",
    "// Decrypt\n",
    "let decrypted_text = decrypt_cbc(&key, &iv, &ciphertext);\n",
    "println!(\"Decrypted Text: {:?}\", String::from_utf8_lossy(&decrypted_text));\n",
    "```\n",
    "\n",
    "```sh\n",
    "+-------------------------------+\n",
    "|                               |\n",
    "|     Key and IV Initialization |\n",
    "|                               |\n",
    "+-------------------------------+\n",
    "               |\n",
    "               v\n",
    "        +--------------+\n",
    "        |              |\n",
    "        |  Encrypt CBC |\n",
    "        |              |\n",
    "        +--------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|     Encrypt Process       |\n",
    "|                           |\n",
    "|                           |\n",
    "|   Input: Plaintext        |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|    Pkcs7 Padding          |\n",
    "|                           |\n",
    "|   Output: Ciphertext      |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|    Encrypted Text Output  |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "        +--------------+\n",
    "        |              |\n",
    "        |   Print      |\n",
    "        | Encrypted    |\n",
    "        | Text         |\n",
    "        +--------------+\n",
    "               |\n",
    "               v\n",
    "+-------------------------------+\n",
    "|                               |\n",
    "|     Decrypt CBC               |\n",
    "|                               |\n",
    "+-------------------------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|     Decrypt Process       |\n",
    "|                           |\n",
    "|                           |\n",
    "|   Input: Ciphertext       |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|    Pkcs7 Padding          |\n",
    "|                           |\n",
    "|   Output: Decrypted Text  |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "+---------------------------+\n",
    "|                           |\n",
    "|  Decrypted Text Output    |\n",
    "|                           |\n",
    "+---------------------------+\n",
    "               |\n",
    "               v\n",
    "        +--------------+\n",
    "        |              |\n",
    "        |   Print      |\n",
    "        | Decrypted    |\n",
    "        | Text         |\n",
    "        +--------------+\n",
    "```\n",
    "\n",
    "This code snippet features two functions: `encrypt_cbc` for encryption and `decrypt` for decryption. The code validates the integrity of the ciphertext and proceeds with the decryption process, considering the nuances of CBC mode and ensuring proper padding removal.\n",
    "\n",
    "In Rust, as in any language, such cryptographic implementations demand attention to detail. The `decrypt_padded_vec_mut` function assumes certain conditions that warrant explicit validation in a real-world scenario. The `decrypt` function, the heart of the operation, orchestrates the decryption process, ensuring adherence to AES specifications in CBC mode.\n",
    "\n",
    "Understanding symmetric-key encryption proves invaluable in penetration testing scenarios, where knowledge of algorithms and modes can enhance success. Rust, with its syntax and constructs, empowers developers to navigate the intricacies of encryption securely. Symmetric-key encryption, while efficient, poses key management challenges, a characteristic where we must exercise attention in key distribution and security protocols. Asymmetric cryptography, a topic yet to be explored in this context, stands as a potential solution to the key distribution difficulty, offering enhanced security measures against unauthorized access."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "9f7bd8d7-08e1-49a5-80d6-0136dab6e59d",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep aes = {version=\"0.8.3\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "e58ba869-2e66-40cc-b6a2-05be1a75aa6a",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep cbc = {version=\"0.1.2\", features=[\"alloc\"]}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "f7dd5852-708c-4a29-b498-e7d839e592da",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Encrypted Text: \"��A�\\u{1f}?_�)�R\\u{5}P���\"\n",
      "\n",
      "Decrypted Text: \"Hello, World!\"\n"
     ]
    }
   ],
   "source": [
    "use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};\n",
    "use cbc::{Encryptor, Decryptor};\n",
    "use hex_literal::hex;\n",
    "\n",
    "type Aes128CbcEnc = Encryptor<aes::Aes128>;\n",
    "type Aes128CbcDec = Decryptor<aes::Aes128>;\n",
    "\n",
    "fn encrypt_cbc(key: &[u8], iv: &[u8], plaintext: &[u8]) -> Vec<u8> {\n",
    "    let mut buf = Vec::from(plaintext);\n",
    "    let cipher = Aes128CbcEnc::new(key.into(), iv.into());\n",
    "    cipher.encrypt_padded_vec_mut::<Pkcs7>(&mut buf)\n",
    "}\n",
    "\n",
    "fn decrypt_cbc(key: &[u8], iv: &[u8], ciphertext: &[u8]) -> Vec<u8> {\n",
    "    let mut buf = Vec::from(ciphertext);\n",
    "    let cipher = Aes128CbcDec::new(key.into(), iv.into());\n",
    "    cipher.decrypt_padded_vec_mut::<Pkcs7>(&mut buf).unwrap()\n",
    "}\n",
    "\n",
    "let key = [0x42; 16];\n",
    "let iv = [0x24; 16];\n",
    "let plaintext = *b\"Hello, World!\";\n",
    "\n",
    "// Encrypt\n",
    "let ciphertext = encrypt_cbc(&key, &iv, &plaintext);\n",
    "println!(\"Encrypted Text: {:?}\\n\", String::from_utf8_lossy(&ciphertext));\n",
    "\n",
    "// Decrypt\n",
    "let decrypted_text = decrypt_cbc(&key, &iv, &ciphertext);\n",
    "println!(\"Decrypted Text: {:?}\", String::from_utf8_lossy(&decrypted_text));"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f4ca74dc-2437-499c-aa9e-e80f033645e5",
   "metadata": {},
   "source": [
    "### 1.5 Asymmetric Encryption\n",
    "\n",
    "In the world of Rust programming, we delve into the world of asymmetric cryptography; A domain that offers solutions to the challenges posed by symmetric-key encryption. Unlike its counterpart, asymmetric cryptography employs two interconnected yet distinct keys: one accessible to the public, the other safeguarded privately. The essence lies in the fact that data encrypted with the private key is decipherable solely by the public key, and vice versa. This nature of the private key ensures the confidentiality of data encrypted with the public key. Additionally, the private key can authenticate a user by enabling them to sign messages, decryptable only by the public key.\n",
    "\n",
    "Now, one might consider the necessity of symmetric-key cryptography given the guarantees provided by public-key encryption. The answer lies in speed; public-key cryptography tends to be slower than its symmetric counterpart. To strike a balance, organizations often adopt a hybrid approach, utilizing asymmetric cryptography for initial communication negotiations and subsequently establishing an encrypted channel for the exchange of a smaller symmetric key, known as a session key.\n",
    "\n",
    "Let's delve into typical use cases of public-key cryptography in Rust, beginning with encryption and signature validation. In the provided Rust code snippet, we observe the implementation of asymmetric encryption and the validation of digital signatures. The main function encompasses key pair generation, encryption, decryption, and signature processes. It's essential to note that while this example is comprehensive, it simplifies the complexities inherent in a practical implementation, which would typically include key exchange between remote nodes.\n",
    "\n",
    "```rust\n",
    "use rsa::{Pkcs1v15Encrypt, RsaPrivateKey, RsaPublicKey};\n",
    "use rsa::pkcs1v15::{SigningKey, VerifyingKey};\n",
    "use rsa::signature::{Signer, Verifier};\n",
    "use rand::thread_rng;\n",
    "use rsa::sha2::{Digest, Sha256};\n",
    "\n",
    "fn generate_key_pair() -> (RsaPrivateKey, RsaPublicKey) {\n",
    "    let mut rng = thread_rng();\n",
    "    let bits = 2048;\n",
    "    let private_key = RsaPrivateKey::new(&mut rng, bits).expect(\"Failed to generate private key\");\n",
    "    let public_key = RsaPublicKey::from(&private_key);\n",
    "    (private_key, public_key)\n",
    "}\n",
    "\n",
    "fn encrypt_decrypt_message(public_key: &RsaPublicKey, private_key: &RsaPrivateKey, message: &[u8]) {\n",
    "    // Encrypt with OAEP padding\n",
    "    let enc_data = public_key\n",
    "        .encrypt(&mut thread_rng(), Pkcs1v15Encrypt, message)\n",
    "        .expect(\"Encryption failed\");\n",
    "    println!(\"Ciphertext: {:?}\\n\", String::from_utf8_lossy(&enc_data));\n",
    "\n",
    "    // Decrypt with OAEP padding\n",
    "    let dec_data = private_key\n",
    "        .decrypt(Pkcs1v15Encrypt, &enc_data)\n",
    "        .expect(\"Decryption failed\");\n",
    "    println!(\"Plaintext: {:?}\\n\", String::from_utf8_lossy(&dec_data));\n",
    "}\n",
    "\n",
    "fn sign_verify_message(private_key: &RsaPrivateKey, public_key: &RsaPublicKey, message: &[u8]) {\n",
    "    // Hash the message using SHA-256\n",
    "    let hash = Sha256::digest(message);\n",
    "\n",
    "    // Sign the hash with PKCS#1 v1.5 padding\n",
    "    let signing_key = SigningKey::<Sha256>::new(private_key.clone());\n",
    "    let signature = signing_key.sign(&hash);\n",
    "    println!(\"Signature: {:?} \\n\", signature);\n",
    "\n",
    "    // Verify\n",
    "    let verifying_key = signing_key.verifying_key();\n",
    "    verifying_key.verify(&hash, &signature).expect(\"failed to verify\");\n",
    "    println!(\"Signature verified\");\n",
    "}\n",
    "\n",
    "let (private_key, public_key) = generate_key_pair();\n",
    "let message = b\"A super duper secret message!\";\n",
    "\n",
    "encrypt_decrypt_message(&public_key, &private_key, message);\n",
    "sign_verify_message(&private_key, &public_key, message);\n",
    "```\n",
    "\n",
    "```sh\n",
    "+---------------------------------+\n",
    "|         generate_key_pair       |\n",
    "|                                 |\n",
    "|            +------+             |\n",
    "|            | RNG  |             |\n",
    "|            +--+---+             |\n",
    "|               |                 |\n",
    "|               v                 |\n",
    "|            +------+             |\n",
    "|            |RSAKey|             |\n",
    "|            |Gen.  |             |\n",
    "|            +---+--+             |\n",
    "|                |                |\n",
    "|                v                |\n",
    "|            +------+             |\n",
    "|            |RSAKey|             |\n",
    "|            |Pub.  |             |\n",
    "|            +------+             |\n",
    "|                |                |\n",
    "|                v                |\n",
    "|           (private_key,         |\n",
    "|            public_key)          |\n",
    "+---------------------------------+\n",
    "                 |\n",
    "                 v\n",
    "+------------------------------------+\n",
    "|      encrypt_decrypt_message       |\n",
    "|                                    |\n",
    "|   +-----------------------+        |\n",
    "|   |   Encrypt with RSA    |        |\n",
    "|   |   (Public Key, OAEP)  |        |\n",
    "|   +-----------+-----------+        |\n",
    "|               |                    |\n",
    "|               v                    |\n",
    "|   +-----------------------+        |\n",
    "|   | Print Ciphertext      |        |\n",
    "|   |        +------+       |        |\n",
    "|   |        | UTF8 |       |        |\n",
    "|   |        +------+       |        |\n",
    "|   +-----------+-----------+        |\n",
    "|               |                    |\n",
    "|               v                    |\n",
    "|   +-----------------------+        |\n",
    "|   |   Decrypt with RSA    |        |\n",
    "|   |   (Private Key, OAEP) |        |\n",
    "|   +-----------------------+        |\n",
    "|               |                    |\n",
    "|               v                    |\n",
    "|   +-----------------------+        |\n",
    "|   | Print Plaintext       |        |\n",
    "|   |        +------+       |        |\n",
    "|   |        | UTF8 |       |        |\n",
    "|   |        +------+       |        |\n",
    "|   +-----------------------+        |\n",
    "+------------------------------------+\n",
    "                 |\n",
    "                 v\n",
    "+--------------------------------------+\n",
    "|      sign_verify_message             |\n",
    "|                                      |\n",
    "|  +--------------------+              |\n",
    "|  | Hash the Message   |              |\n",
    "|  |   (SHA-256)        |              |\n",
    "|  +--------+-----------+              |\n",
    "|           |                          |\n",
    "|           v                          |\n",
    "|  +--------------------+              |\n",
    "|  | Print Hash         |              |\n",
    "|  |      +------+      |              |\n",
    "|  |      | UTF8 |      |              |\n",
    "|  |      +------+      |              |\n",
    "|  +--------------------+              |\n",
    "|           |                          |\n",
    "|           v                          |\n",
    "|  +--------------------+              |\n",
    "|  | Sign Hash with RSA |              |\n",
    "|  |  (Private Key,     |              |\n",
    "|  |   PKCS\\#1 v1.5)    |              |\n",
    "|  +--------+-----------+              |\n",
    "|           |                          |\n",
    "|           v                          |\n",
    "|  +--------------------+              |\n",
    "|  | Print Signature    |              |\n",
    "|  |      +------+      |              |\n",
    "|  |      |UTF8HEX|     |              |\n",
    "|  |      +------+      |              |\n",
    "|  +--------------------+              |\n",
    "|           |                          |\n",
    "|           v                          |\n",
    "|  +--------------------+              |\n",
    "|  | Verify Signature   |              |\n",
    "|  |   (Public Key,     |              |\n",
    "|  |    PKCS\\#1 v1.5)   |              |\n",
    "|  +--------------------+              |\n",
    "|           |                          |\n",
    "|           v                          |\n",
    "|  +--------------------+              |\n",
    "|  | Print \"Signature   |              |\n",
    "|  | Verified\"          |              |\n",
    "|  +--------------------+              |\n",
    "+--------------------------------------+\n",
    "\n",
    "```\n",
    "\n",
    "This Rust program illustrates two fundamental functions in public-key cryptography - encryption/decryption and message signing. The program begins by generating a key pair, followed by operations such as encrypting a message with the public key, decrypting it with the private key, and verifying the message signature using the public key. This example serves as an introduction to the essential concepts of asymmetric cryptography within the Rust programming language."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "696f0574-442d-4147-a251-7fb94db59c25",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep rsa = {version=\"0.9.6\", features=[\"sha2\"]}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "26012acd-3d16-46ac-b336-736f49f4e241",
   "metadata": {},
   "outputs": [],
   "source": [
    ":dep rand = {version=\"0.8.5\"}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "25076a87-24c9-4012-8b47-6e39538484ea",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Ciphertext: \"����=e�)�\\u{1f}\\u{15}y�Qj��-����˾-��V��i�\\u{3}Q�9g\\u{16}⍣���R�\\u{13} �]\\u{6}o�\\u{18}I���Ju+\\u{13}\\u{f}��_\\u{10}�°�\\u{13}�0Τ��\\u{5}�����\\u{1f}�\\u{1e}\\u{8}&\\u{7f}���4��\\u{1d}�c>\\u{8}g��MeQF\\u{17}�v�o����u�KR���Y�\\u{7a6}�\\u{f}\\u{14}h\\u{3}��\\u{f}e\\u{1d}{�g�����\\u{e}����K�\\u{3}-\\rR�ԧ�\\u{f}�&��f������Q}lt0�8Lr\\u{59b}���cφMʙ_���n,è���'{\\u{18}�`E�%W\\u{14}vL�\\u{1f}�\\u{3}�&�|��~t\\u{c}Z*����\\\\.������8�*�Ԯ<�e\"\n",
      "\n",
      "Plaintext: \"A super duper secret message!\"\n",
      "\n",
      "Signature: Signature(\"08237351B51C72F47641724FAB834BA9FAE5BEC23C62D2A69AE1BAFAEE4EB038D44ED63AE9A4810488C67588F7AB63EDF6F8C205DCF328C6364FE18B8350BFAE652DCED9AE1194BEE700AFE65C37588D563B71EF6A4471C4D708942847B06363645AD0964703919C1190BE415164B2FCFCCB27A6847ADAA53BC597BED36098CB38D6105D721583C0923CD01CCDAC72234DB2840C1298607DD83182FA58D498999ECDF55CC6B08BA733DC168F770741159F5D48BD99B6515771A9EF8DEDDFDA333A03C43C1330EA2C59C9BBDFCEB8F8583BDCF7B8DCE853C9BC6AD54FA2854BCDAC7A1F5602C9C9280F64B15B6B8D6911B59626500391C47AD00838187D087800\") \n",
      "\n",
      "Signature verified\n"
     ]
    }
   ],
   "source": [
    "use rsa::{Pkcs1v15Encrypt, RsaPrivateKey, RsaPublicKey};\n",
    "use rsa::pkcs1v15::{SigningKey, VerifyingKey};\n",
    "use rsa::signature::{Signer, Verifier, Keypair};\n",
    "use rand::thread_rng;\n",
    "use rsa::sha2::{Digest, Sha256};\n",
    "\n",
    "fn generate_key_pair() -> (RsaPrivateKey, RsaPublicKey) {\n",
    "    let mut rng = thread_rng();\n",
    "    let bits = 2048;\n",
    "    let private_key = RsaPrivateKey::new(&mut rng, bits).expect(\"Failed to generate private key\");\n",
    "    let public_key = RsaPublicKey::from(&private_key);\n",
    "    (private_key, public_key)\n",
    "}\n",
    "\n",
    "fn encrypt_decrypt_message(public_key: &RsaPublicKey, private_key: &RsaPrivateKey, message: &[u8]) {\n",
    "    // Encrypt with OAEP padding\n",
    "    let enc_data = public_key\n",
    "        .encrypt(&mut thread_rng(), Pkcs1v15Encrypt, message)\n",
    "        .expect(\"Encryption failed\");\n",
    "    println!(\"Ciphertext: {:?}\\n\", String::from_utf8_lossy(&enc_data));\n",
    "\n",
    "    // Decrypt with OAEP padding\n",
    "    let dec_data = private_key\n",
    "        .decrypt(Pkcs1v15Encrypt, &enc_data)\n",
    "        .expect(\"Decryption failed\");\n",
    "    println!(\"Plaintext: {:?}\\n\", String::from_utf8_lossy(&dec_data));\n",
    "}\n",
    "\n",
    "fn sign_verify_message(private_key: &RsaPrivateKey, public_key: &RsaPublicKey, message: &[u8]) {\n",
    "    // Hash the message using SHA-256\n",
    "    let hash = Sha256::digest(message);\n",
    "\n",
    "    // Sign the hash with PKCS#1 v1.5 padding\n",
    "    let signing_key = SigningKey::<Sha256>::new(private_key.clone());\n",
    "    let signature = signing_key.sign(&hash);\n",
    "    println!(\"Signature: {:?} \\n\", signature);\n",
    "\n",
    "    // Verify\n",
    "    let verifying_key = signing_key.verifying_key();\n",
    "    verifying_key.verify(&hash, &signature).expect(\"failed to verify\");\n",
    "    println!(\"Signature verified\");\n",
    "}\n",
    "\n",
    "let (private_key, public_key) = generate_key_pair();\n",
    "let message = b\"A super duper secret message!\";\n",
    "\n",
    "encrypt_decrypt_message(&public_key, &private_key, message);\n",
    "sign_verify_message(&private_key, &public_key, message);"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "da11bb09-1611-4bbf-8b3b-45c08a0118a6",
   "metadata": {},
   "source": [
    "---"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Rust",
   "language": "rust",
   "name": "rust"
  },
  "language_info": {
   "codemirror_mode": "rust",
   "file_extension": ".rs",
   "mimetype": "text/rust",
   "name": "Rust",
   "pygment_lexer": "rust",
   "version": ""
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}